Amazed nobody commented on this. I know there is a lot of information but from technical point of view imho it is impossible to comply fully. Moreover I actually believe it creates more not less security risks. I reduced caching expiration time within the days to remove limit and for archives I listed up the most important ones in the executing rights procedure with feedback to customer for feedback about other urls they are concerned with. Even though lawfully this information is classified differently.